2

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we run WireShark for packet capturing it will only display packets that the computer itself is connected to. So we can't see anything incoming to our IP specially a flood attack. So is there anyway to check all the packets?

Thanks.

3 Answers 3

2

If you are doing port-forwarding on your router to one specific PC IP address, you can run packet capturing software like wireshark on that PC and you should see the traffic. This is regard incoming traffic only.

If you are interested in outgoing traffic, packet capturing should be done on a central point like default gateway.

1
  • Thanks that helped. All I needed it for was for incoming traffic.
    – Asad Moeen
    May 12, 2012 at 13:28
2

It is quite difficult to do this on a home network. The switches that are built into domestic routers, aren't really setup to do this, and as you probably see, only allow you to see your own traffic and broadcasts from other users. You really need an business-grade switch/router that allows you to configure what is known as port-mirroring. This would allow a copy of traffic to be sent to a nominated port that you can sniff with Wireshark. Open-source router firmware like OpenWRT allow you do this on a domestic router, but only some are supported, and might be beyond the average user to setup.

There are a few other methods outlined here, http://wiki.wireshark.org/CaptureSetup/Ethernet

0
1

As martyvis said in his answer you can't really do this out of the box with most home / consumer setups. You need to separate your internet connection from the LAN router by using a separate ADSL or cable modem.

Once you have separated your Internet connectivity from your LAN you can start looking at where to put the traffic monitoring. You can, for example, put a hub (if you can still find one) between the internet modem and the LAN router/firewall which will let you see everything going into and out of your LAN.

2
  • Before you go looking for a hub, be sure to read the page on Ethernet hubs at the Wireshark site. Some late-model "hubs" are actually switches.
    – sawdust
    May 12, 2012 at 23:15
  • I didn't know that - shows how long it's been since I needed to do this stuff in anger!
    – MarcE
    May 13, 2012 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.